Upwind

Upwind is a cloud-native application protection platform (CNAPP) pairing cloud posture management with an eBPF runtime sensor, sold by quote to security teams.

Upwind finds the cloud risks that matter at runtime, then helps a security team fix them and catch new attacks as they happen. It reads workloads, APIs, containers and AI services across AWS, Azure and Google Cloud in one platform. Upwind Security makes it, and the team behind Spot.io started the company in San Francisco in October 2022. The product carries the company's name and is the one platform it sells. Security Posture groups three modules: CSPM for misconfigurations, CIEM for identity entitlements, and DSPM, a continuous data catalog that locates personal, payment and health data. Attack Path and Exposure Analysis connects cloud and identity insights into one attack graph and ranks fixes by blast radius. Vulnerability Management combines agentless scanning with eBPF runtime coverage, so findings reflect what is actually running. Threat Detection and Cloud Detection and Response use eBPF-powered sensors to flag privilege escalations, network anomalies and malicious execution. Further modules cover API security, serverless functions, AI-SPM for models and data pipelines, IaC security in CI/CD, and SCA with SBOMs for the software supply chain. Upwind suits security and cloud platform teams that run workloads on more than one cloud and want runtime evidence behind each posture finding. Organizations with heavy Kubernetes, container and serverless use get detection inside running pods alongside account configuration. Teams building AI services see model and pipeline settings next to the rest of the estate. Buyers get a quote once a demo is done, either directly or through AWS Marketplace, and Upwind runs a managed detection and response service for teams that want help watching around the clock. Security engineers use it to triage findings by blast radius, then push prioritized fixes into Jira or Slack with clear accountability. Platform engineers rely on the IaC and SCA checks to stop risky infrastructure changes and vulnerable dependencies before they ship. Incident responders work from the runtime detections to see what an attacker did inside a container. Data and AI teams use the DSPM catalog and AI-SPM checks to find exposed sensitive data and risky model configurations before an attacker does.